Published: January 2016

Physical Layer – Facility

Customer data is stored in our Office 365 datacenters that are geographically distributed while taking regional data location considerations into account. Our datacenters are built from the ground up to protect services and data from harm by natural disaster or unauthorized access. Datacenter access is restricted 24 hours a day by job function—with only customer application and services access given to essential personnel. Physical access control uses multiple authentication and security processes, including badges and smart cards, biometric scanners, on-premises security officers, continuous video surveillance, and two-factor authentication. The datacenters are monitored using motion sensors, video surveillance, and security breach alarms. In case of a natural disaster, security also includes automated fire prevention and extinguishing systems and seismically braced racks where necessary.

Physical Layer – Network

Perimeter protection is implemented through the use of controlled devices at the network edge and on points throughout the network. The overarching principle of our network security is to allow only connections and communications that are necessary to allow systems to operate, blocking all other ports, protocols and connections. Access Control Lists (ACLs) implemented in the form of tiered ACLs on routers, IPsec policies on hosts, firewall rules and host based firewall rules are implemented in the network with restrictions on network communication, protocols, and port numbers. Edge router security allows the ability to detect intrusions and signs of vulnerability at the network layer. Networks within the Office 365 datacenters are further segmented to provide physical separation of critical back-end servers and storage devices from the public-facing interfaces.

Logical Layer

The logical layer of security involves many controls and processes implemented to secure the host machines, applications running on those hosts and from administrators that may perform any work on those host machines and applications.